{"id":"CVE-2026-123595","published":"2026-11-08T02:16:53.863","lastModified":"2026-11-10T22:15:59.797","description":"Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC3 handler, which matches the closest encloser by hash alone without checking the type bitmap and so accepts parent-side ancestor-delegation NSEC3 records as proof of nonexistence. An attacker who delivers one response built from genuinely signed parent NSEC3 records can cause NXDOMAIN or NODATA to be cached with AD=1, denying resolution of existing names at and below the zone cut.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-345"],"vendors":[],"products":[],"references":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-624w-vvww-xvpw","tags":[]},{"url":"https://www.vulncheck.com/advisories/hickory-dns-through-0.26.0-alpha.1-dnssec-validation-bypass-via-ancestor-delegation-nsec3","tags":[]}],"exploitRefs":[{"url":"https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-624w-vvww-xvpw","tags":[]}],"hasPoc":true,"ai":{"summary":"A DNSSEC validation flaw in Hickory DNS's NSEC3 handler incorrectly accepts parent-side ancestor-delegation NSEC3 records as proof of nonexistence by matching only the closest encloser hash without verifying the type bitmap. This allows an attacker to cause legitimate names to be cached as NXDOMAIN or NODATA with AD=1, breaking resolution for valid domains at and below the zone cut.","exploitability":"Exploitation requires the attacker to control or intercept DNS responses and deliver a specially crafted response containing validly signed parent-side NSEC3 records, which is feasible in certain network positions (e.g., MITM or compromised resolver infrastructure) but not trivial for remote unauthenticated attackers.","blast_radius":"Successful exploitation can cause widespread denial of service for affected zones, as legitimate queries for existing names will be incorrectly resolved as non-existent, potentially impacting all downstream clients using the vulnerable recursor.","remediation":"Upgrade to hickory-proto/hickory-net version 0.26.2 or later, which includes the fix for the NSEC3 validation flaw.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dnssec","validation-bypass","dos","recursor"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:53:58.367Z"}}